Related Posts

Cisco Released IOS XR Software Security Advisory

Cisco Released IOS XR Software Security Advisory

[[{“value”:”

Cisco Systems, Inc., announced the release of its semiannual security advisory bundle, which addresses critical vulnerabilities in its IOS XR Software.

This publication is part of Cisco’s commitment to transparency and continuous improvement in cybersecurity. It aligns with their scheduled advisory releases on the second Wednesday of March and September each year.

Cisco’s decision to release bundled advisories directly results from customer feedback.

The company acknowledges the importance of customer input in shaping its security protocols and updating schedules.

This customer-centric approach ensures that users are well-informed and can plan their maintenance activities effectively.

Details of the March 2024 Security Advisories

The latest release includes eight advisories that detail nine vulnerabilities affecting Cisco IOS XR Software.

Document

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

:

The problem of vulnerability fatigue today
Difference between CVSS-specific vulnerability vs risk-based vulnerability
Evaluating vulnerabilities based on the business impact/risk
Automation to reduce alert fatigue and enhance security posture significantly

AcuRisQ, that helps you to quantify risk accurately:

If left unpatched, these vulnerabilities could allow attackers to exploit the system, leading to potential unauthorized access, denial of service, or other malicious activities.

The following table identifies Cisco Security content that is associated with this bundled publication:

Cisco Security AdvisoryCVE IDSecurity Impact RatingCVSS Base ScoreCisco IOS XR Software SSH Privilege Escalation VulnerabilityCVE-2024-20320High7.8Cisco IOS XR Software for ASR 9000 Series Aggregation Services Routers PPPoE Denial of Service VulnerabilityCVE-2024-20327High7.4Cisco IOS XR Software Layer 2 Services Denial of Service VulnerabilityCVE-2024-20318High7.4Cisco IOS XR Software iPXE Boot Signature Bypass VulnerabilityCVE-2023-20236Medium6.7Cisco IOS XR Software Authenticated CLI Secure Copy Protocol and SFTP Denial of Service VulnerabilityCVE-2024-20262Medium6.5Cisco IOS XR Software MPLS and Pseudowire Interfaces Access Control List Bypass VulnerabilitiesCVE-2024-20315 CVE-2024-20322Medium5.8Cisco IOS XR Software DHCP Version 4 Server Denial of Service VulnerabilityCVE-2024-20266Medium5.3Cisco IOS XR Software SNMP Management Plane Protection ACL Bypass VulnerabilityCVE-2024-20319Medium4.3

Cisco has identified these issues and provided software updates to mitigate the risks associated with these vulnerabilities.

Importance of Software Updates

Cisco strongly recommends that customers apply the provided updates as soon as possible.

Software updates are a crucial defense against cyber threats, and keeping systems up-to-date is essential for maintaining network security and integrity.

Customers can access updates and detailed information about each vulnerability on the Cisco Security Advisories page.

Customers can view the detailed advisories and obtain the necessary software updates by visiting the Cisco Security Advisory website at Cisco Security Advisories.

Here, users can find comprehensive information about the vulnerabilities, affected products, and steps to apply the updates.

Cisco’s Commitment to Security

Cisco’s regular security advisory publications underscore the company’s dedication to cybersecurity and proactive approach to addressing potential threats.

Cisco is committed to protecting its clients’ network environments by adhering to a predictable release schedule and actively incorporating customer feedback.

With Perimeter81 malware protection, you can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits. All are incredibly harmful and can wreak havoc on your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

The post Cisco Released IOS XR Software Security Advisory appeared first on Cyber Security News.

“}]]   Read More 

Cyber Security News 

Scammers are impersonating cryptocurrency exchanges, FBI warns

Scammers are impersonating cryptocurrency exchanges, FBI warns

The Federal Bureau of Investigation (FBI) issued a public service announcement warning the public about scammers impersonating cryptocurrency exchange employees to steal funds.

There are many types of crypto related scams, but in this case, the FBI provided an advisory about scammers that contact the target and pretend to be employees of a cryptocurrency exchange.

As scammers almost always do, they try to impose a feeling of urgency on the target, making potential victims feel as though they must act quickly because of, say, an acute problem with their account. Such an account may be allegedly compromised, or scammers could trick a victim into thinking that a third party is trying to gain access and withdraw funds from the account.

The scammer then offers to help the target to secure their funds, but to do so, the scammer—posing as a legitimate employee of the cryptocurrency exchange—first needs the victim’s log in credentials. Sometimes, scammers also send a malicious link to the victim which takes the victim to a illegitimate site that can collect identification information.

Armed with the information the target provided, the scammer drains the account. In a sense, the false warning that first came from the scammer was true—someone was after their account, it’s just that this specific someone was the person talking to the victim themselves.

Very similar scams exist that involve bank accounts, but most people are aware of how they can check and verify that the person they are in contact with actually works for their bank. With cryptocurrency exchanges, this is often not true.

Also, we see a lot of scary stories in the news about exchanges getting robbed or even disappearing with their customer’s money. Some crypto-related scams often deploy imposter websites which are hard to discern from the real ones.

Recovery services are another successful avenue for scammers. In June, the FBI warned of fraudsters posing as lawyers representing fictitious law firms that contact scam victims and offer their services, claiming to have the authorization to investigate fund recovery cases.

These scammers are usually after more money or personal information that could lead to identity theft.

The California Department of Financial Protection & Innovation (DFPI) has a very useful crypto scam tracker that allows visitors to read and search through hundreds of different real-life scenarios of crypto-related scams.

How not to fall victim to crypto-related scams

The most important ground rule when it comes to cryptocurrency or financial scams of any kind is: if it sounds too good to be true, it likely is.

Besides that, there are a few other guidelines that can keep you out of trouble.

Don’t respond to messages, emails or other communications that arrive unexpectedly or from strange senders/phone numbers.

First verify that the person you are communicating with represents the company they claim to work for. Do this using another channel. A call to a number you know to be legitimate, for example.

Don’t let scammers rush you into decisions or actions. They try to make you feel a sense of urgency, so you don’t take the necessary time to think things through.

Always research whether the cryptowallet, cryptoexchange, or app they are sending you to is trustworthy before signing up for it or installing something.

Use multi-factor authentication (MFA) for existing accounts which makes it harder for anyone to take over your account.

Never give out more information than absolutely necessary. A legitimate company will not ask for more information.

The FBI requests victims report activity associated with this scam to the FBI IC3 at www.ic3.gov.

The FBI also requests victims provide any transaction information associated with the scam. For more information on what to provide the FBI, see prior IC3 PSA Alert Number I-082423-PSA.

We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your—and your family’s—personal information by using identity protection.

 Read More 

 

Deepfake Taylor Swift images circulate online, politicians call for laws to ban deepfake creation

Deepfake Taylor Swift images circulate online, politicians call for laws to ban deepfake creation

[[{“value”:”

Deepfake images of Taylor Swift have really made some serious waves. Explicit images of the popstar, generated by Artificial Intelligence (AI) were posted on social media and Telegram. The images were viewed millions of times.

The impact of the deepfake was enormous. Social media platform X (formerly known as Twitter) even blocked searches for Taylor Swift’s name, saying:

“This is a temporary action and done with an abundance of caution as we prioritize safety on this issue.”

X’s policies say it explicitly prohibits the sharing of “synthetic, manipulated, or out-of-context media that may deceive or confuse people and lead to harm”, as well as the posting of Non-Consensual Nudity (NCN) images. But apparently it was not easy to quickly remove the images and take actions against the accounts that were posting them.

Searches for Taylor Swift and some related terms were also blocked on Instagram, instead displaying “the search terms used were sometimes associated with activities of dangerous organizations and individuals.”

The uproar about the fake images of the popstar was so loud that some politicians started calling for laws to prohibit the creation of deepfakes. While in many countries and some US states, the creation of deepfakes is prohibited, there are currently no federal laws against the sharing or creation of deepfake images.

In 2020 we discussed deepfake legislation in the United States. In a rare example of legislative haste, roughly one dozen state and federal bills were introduced in 2019 to regulate deepfakes, mostly out of fear that they could upend democracy.

Although it is doubtful that any law would have stopped the creation of the images, it might have blocked or dampened the rapid way in which the images were spread.

However, deepfakes started as a new form of pornography and most of the deepfakes created and posted online today are still of a pornographic nature. They also disproportionally target women, which should make appropriate legislation a bigger priority than being able to recognize deepfakes.

Like Adam Dodge, founder of the nonprofit End Technology-Enabled Abuse, or EndTAB, said a few years ago:

“The reality is, when it comes to the battle against deepfakes, everybody is focused on detection, on debunking and unmasking a video as a deepfake. That doesn’t help women, because the people watching those videos don’t care that they’re fake.”

Well-known women, like actresses and musicians, are particularly at risk of falling victim to this type of abuse.

Taylor Swift herself is furious about the AI images circulating online and is considering legal action against the sick deepfake porn site hosting them.

Taylor Swift has a legal team at her disposal, but if you are the victim of “revenge porn” or other forms of non-consensual nudity, you should know it’s much easier to take down nonconsensual porn content than it used to be. A growing number of companies will voluntarily take down nonconsensual porn on their platforms, regardless of whether the victim owns the copyright.

For step-by-step instructions on how to report and take down nonconsensual porn across multiple technology platforms including Instagram, X (Twitter), Reddit, Tumblr, Google, Facebook, and TikTok, you can use Cyber Civil Rights Initiative’s new Online Removal Guide.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

“}]]   Read More 

Malwarebytes